[Bug 561895] conglomerate 0.9.2 crashes

If you have any questions why you received this email, please see the text =
at
the end of this email. Replies to this email are NOT read, please see the t=
ext
at the end of this email. You can add comments to this bug at:
  http://bugzilla.gnome.org/show_bug.cgi?id=3D561895

  conglomerate | Code | Ver: unspecified

Andrew Clayton changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[email protected]




------- Comment #1 from Andrew Clayton  2009-07-22 18:56 UTC -------
Sounds like the problem I was seeing.

I tracked it down to a memory allocation problem in =

src/cong-location.c::cong_location_del_next_char()

First a new string is defined.

gchar *new_text;

Then it is assigned a value by

new_text =3D g_strndup (cong_node_safe_get_content(loc->node), loc
->byte_offset);

Then a character gets appended onto the end

new_text =3D strcat (new_text, char_after_next);

Finally this is freed

g_free (new_text);

And this is where I was finding it crashing with a glibc error of

"glibc detected free invalid next size fast"


The problematic part is the strcat(). I guess new_text is basically being
overflowed at that point. What needs to be done is to reallocate memory for
new_text + 2 (one for the character being appended and one for the NULL byte

i.e

new_text =3D g_realloc(new_text, strlen(new_text) + =

                               strlen(char_after_next) + 1);

Just before the strcat. This certainly fix's the crashing when using backsp=
ace
and a simple test program containing the above leaves a valgrind
--leak-check=3Dfull happy.

Anyway, I'll attach the patch for the above.



-- =

See http://bugzilla.gnome.org/page.cgi?id=3Demail.html for more info about =
why you received
this email, why you can't respond via email, how to stop receiving
emails (or reduce the number you receive), and how to contact someone
if you are having problems with the system.

You can add comments to this bug at http://bugzilla.gnome.org/show_bug.cgi?=
id=3D561895.